Back to Checks
okta

Every active Okta Password Policy enforces a minimum password age of 24 hours

authenticator_password_minimum_age_24h
Service: authenticatorSeverity: low
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

Every active Okta Password Policy must prevent users from changing their password again for at least 24 hours (1440 minutes) after the previous change.

A minimum age stops users from cycling through their entire history in one session to land back on a previously-known password. The check emits one finding per active policy.

Prowler logoProwlerprowler-provider-okta

Risk

Without a minimum password age, users can sidestep history and rotation requirements in minutes.

  • Defeats password history by walking through new passwords back to a previous one
  • Defeats forced rotation by returning to the prior password after the mandatory change
  • Inconsistent baselines leave users on legacy policies with shorter minimums than the default

Run this check with Prowler

Run in Prowler Cloud
Run
prowler okta --checks authenticator_password_minimum_age_24h

Recommendation

Configure every active Okta Password Policy so:

  • Minimum password age is 1440 minutes (24 hours) or more
  • Group assignments do not route users to legacy policies with shorter minimums or no minimum age

Review each active Password Policy individually — the check evaluates them one at a time.

Remediation

Terraform

resource "okta_policy_password" "<example_resource_name>" {
  name                  = "<example_resource_name>"
  status                = "ACTIVE"
  password_min_age_minutes = 1440  # Critical: STIG-aligned 24h minimum age
}

Other

1Sign in to the **Okta Admin Console** as a *Super Admin*.
2Navigate to **Security** > **Authentication** > **Password**.
3For every active policy, click **Edit** and set *Minimum password age* to `24` hours (`1440` minutes) or more.
4Save the policy.
5Repeat for every active Password Policy returned by the check.

Check Code

from prowler.lib.check.models import Check, CheckReportOkta
from prowler.providers.okta.services.authenticator.authenticator_client import (
    authenticator_client,
)
from prowler.providers.okta.services.authenticator.lib.password_policy_helpers import (
    active_password_policies,
    missing_password_policies_scope_finding,
    no_active_password_policies_finding,
    password_policy_label,
)


class authenticator_password_minimum_age_24h(Check):
    """STIG V-273200 / OKTA-APP-000740.

    Every active Okta Password Policy must enforce a 24-hour minimum password age.
    The check emits one finding per active policy so a weaker
    custom policy cannot hide behind a compliant default.
    """

    def execute(self) -> list[CheckReportOkta]:
        """Evaluate all active Okta Password Policies."""
        findings = []
        org_domain = authenticator_client.provider.identity.org_domain
        requirement = "minimum password age of at least 24 hours"
        missing_scope = authenticator_client.missing_scope.get("password_policies")

        if missing_scope:
            return [
                missing_password_policies_scope_finding(
                    self.metadata(), org_domain, missing_scope, requirement
                )
            ]

        policies = active_password_policies(authenticator_client.password_policies)
        if not policies:
            return [
                no_active_password_policies_finding(
                    self.metadata(), org_domain, requirement
                )
            ]

        for policy in policies:
            report = CheckReportOkta(
                metadata=self.metadata(), resource=policy, org_domain=org_domain
            )
            if policy.min_age_minutes is not None and policy.min_age_minutes >= 1440:
                report.status = "PASS"
                report.status_extended = (
                    f"{password_policy_label(policy)} enforces {requirement} "
                    f"(minimum age minutes: {policy.min_age_minutes})."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"{password_policy_label(policy)} does not enforce {requirement} "
                    f"(minimum age minutes: {policy.min_age_minutes})."
                )
            findings.append(report)
        return findings

References